One Binary, Every Package Manager: Shipping a Rust CLI To PyPI, Npm, Homebrew, Winget…
Provides one Binary, Every Package Manager: Shipping a Rust CLI To PyPI, Npm, Homebrew, Winget… and evaluates key implications for security practitioners.
Summary
Motivation: Managing .env Chaos
Ajit Kumar describes building EVNX, a Rust CLI to manage proliferating .env, .env.example, and environment-specific files, plus conversions to Docker formats and cloud secret managers. Lack of .env standards breaks migrations between platforms like AWS Secrets Manager.
Why Rust and Cargo
Choosing Rust over Python or C++ for CLI development, Kumar highlights Cargo’s integrated test, build, and publish workflow and Rust’s security and memory safety. Rust’s crates.io registry lets developers install binaries via cargo install.
Distribution Challenge
Publishing to crates.io is straightforward—cargo login, dry-run, publish—but permanent versioning means releases cannot be recalled, only yanked from search. Kumar notes a gap: a general-purpose CLI must reach developers who use Python pip, JavaScript npm, and other ecosystems, not only Rust users.
Talk Scope
The session introduces shipping one binary across package managers; available transcript material focuses on EVNX origin and Rust crate publishing rather than detailed multi-ecosystem packaging steps.
Related talks
The Linux Foundation·38 min
Damián Vicino
Presents package Managers Metadata and Cross Ecosystem Projects in the Era of SBOMs and evaluates key implications for security practitioners.
The Linux Foundation·11 min
Provides bazelCon 2019 Day 1: Lightning Talk - Package manager integration with Bazel and evaluates key implications for security practitioners.
Security Fest·37 min
Rotem Bar [Security Fest 2022]
Rotem Bar [Security Fest 2022] details Do you trust your package manager?.


